Bitrix24 MCP Server (lstkhN)
Bitrix24 MCP Server
A module for on-premise Bitrix24: an agent safely reads CRM, the MySQL schema, code and business processes over SSH stdio or HTTP with a Bearer token
- 0 ★ on the repository
- Last commit
Extended access
Why this level
- The server reads CRM with customers' personal data, the database schema and project files on a production server
- The HTTP entry point exposes access to data: protect it with a token, HTTPS and network isolation
Install
- Works in
- Services
Manual install
composer install --no-dev --prefer-dist --optimize-autoloaderRun in `/local/modules/bitrix24.mcp/` after copying the repository, then install the module in Installed solutions.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The server reads CRM with customers' personal data, the database schema and project files on a production server
- The HTTP entry point exposes access to data: protect it with a token, HTTPS and network isolation
This is third-party code. Review the repository files before installing.
What it does
The project installs on an on-premise Bitrix24 server as the local `bitrix24.mcp` module in `/local/modules/` and gives an agent read-only access. Through MCP the agent sees leads, deals, contacts and companies, activities and timeline entries, the CRM schema with custom fields and statuses, and the MySQL table schema from `INFORMATION_SCHEMA`. There are also developer tools: `code_search` searches text or a regular expression across files, `class_inspector` parses PHP classes through reflection, `components_list` and `event_handlers` show components and event handlers, and `modules_list` lists modules with versions. `bizproc_reader` reads templates, instances, tasks and history of business processes. `sql_query` runs `SELECT` only, up to 200 rows. MCP resources serve a project map, D7 documentation and development standards. There are two transports. Stdio over SSH exposes no address: the client runs `cli/server.php` on the server. Streamable HTTP works with a Bearer token, MCP sessions bound to the token and scope limits such as `crm:read`, `tools:list` and `resources:read`. The project has no CRM write operations.
Who it is for. Developers and administrators of on-premise Bitrix24 who need an agent to analyze the CRM, database structure and project code with no right to change anything.
Good fit when
- Before changing the CRM an agent studies the field and status schema and shows custom fields of leads and deals
- A business process behaves oddly and you want to see its template, instances and history
- You search the project for where a function is used or which event handler hooks into a module
- The agent connects to the server over SSH and you do not want an MCP address on the internet
- The agent's access should be cut to CRM reading by issuing a token with only the `crm:read` scope
Not a fit when
- Your portal runs in the Bitrix24 cloud: the project targets Box and the cloud REST adapter remains a stub
- You need CRM writes, creating deals and tasks: the project has no change operations
- You need an SQL sandbox: `sql_query` is meant for `SELECT` and does not replace database isolation
- You cannot install modules into `/local/modules/` and lack PHP 8.1: the project will not start without them
Example request
Show the CRM schema, custom deal fields and statuses, then find event handlers in the project related to the crm module.MCP
- Transport
- stdio, http
- Authentication
- API key
Limitations
PHP 8.1 or newer, Composer, Bitrix24 Box with D7 and the ability to install local modules are required. Installation: copy the repository into `/local/modules/bitrix24.mcp/`, run `composer install --no-dev`, then install the module in Installed solutions. A random Bearer token is created on install and should not be left in Git, tickets or shell history.
The client runs requests with the PHP and Bitrix user rights the server runs under. The token confirms access to the endpoint but does not replace network isolation and OS rights. CRM output is limited to 100 records per call, `sql_query` returns up to 200 rows and `file_reader` reads up to 1 MiB.
The `generate-config.php` script prints a secret to the console, so run it in a protected environment. The package name `bitrix24/mcp` and the contact address in composer.json do not mean the project is official.
How to disable. Uninstall the module in Installed solutions or remove the `/local/modules/bitrix24.mcp/` directory and delete the `/local/mcp/index.php` entry point. The token stops working with it.
FAQ
How do I connect Bitrix24 Box to Claude Code?
Install the module, then add a server to `.mcp.json` with the `ssh` command and the arguments `bitrix@your-server.example` and `php /path/to/bitrix/local/modules/bitrix24.mcp/cli/server.php`. SSH is configured separately, for example in `~/.ssh/config`.
Can the server change CRM data?
No, the project has no CRM write operations or arbitrary DML. The `sql_query` tool is meant for `SELECT` but must not be treated as an SQL sandbox.
How do I limit token permissions?
Set the module option `auth_scopes` to a JSON array such as `["crm:read","tools:list","resources:read"]`. The agent then sees the tool list and CRM data but not the rest.
How do I connect the server over HTTP?
Copy `public/mcp-endpoint.php` to `/local/mcp/index.php` or wire up the `routes/mcp.php` route. All requests except OPTIONS carry an `Authorization: Bearer <TOKEN>` header, and the token must not go into the URL.
Does the server suit cloud Bitrix24?
No, it is not a ready connector for Bitrix24 Cloud. The REST adapter for the cloud is described in `docs/rest-adapter.md` as a separate stub.
Discussion
No questions or reviews yet.
Related
All Bitrix24 toolsBitrix24 MCP by Bit2Beat
Bitrix24 MCP Server
Bitrix24 MCP server over an inbound webhook: CRM, tasks, disk, calendar, chat, business processes and config migration between portals
Bitrix24 MCP server: tasks, CRM and lists
Bitrix24 Tasks, CRM & Lists MCP Server
A modular Bitrix24 MCP server with 46 tools for tasks and kanban, CRM deals and contacts, and universal lists, running in Docker with no third-party cache
Bitrix24 MCP Server (gunnit)
Bitrix24 MCP Server
A TypeScript MCP server for Bitrix24 CRM: contacts, companies, leads, deals, tasks and sales rep performance reports
A read-only MCP server that reads Bitrix24 deals, contacts and companies with SELECT queries against the database, bypassing the REST API
Bitrix24 MCP Server (qwito)
Bitrix24 MCP Server
A TypeScript MCP server with 45-plus tools for Bitrix24 CRM: contacts, deals, leads, companies, tasks and activity analytics
A compact Bitrix24 MCP server on an inbound webhook: tasks, groups, kanban stages and task comments
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| Bitrix24 MCP Server (lstkhN) (this card) | no | API key | 0 | |
| Bitrix24 MCP by Bit2Beat | no | API key | 6 | a REST-based server with no access to code and the database schema |
| Yandex Tracker MCP Server with issue validation | no | API key | 0 | a Yandex Tracker server, a different task system |
README in short
The README explains the purpose, requirements, module installation, connecting over SSH stdio and Streamable HTTP, a tool table with limits, MCP resources and permissions with scopes. The project is MIT licensed, the Composer package is `bitrix24/mcp` and the module id is `bitrix24.mcp`.